
CVE-2022-29976
https://notcve.org/view.php?id=CVE-2022-29976
11 May 2022 — An Authenticated Reflected Cross-site scripting at BCC Parameter was discovered in MDaemon before 22.0.0 . Se ha detectado una vulnerabilidad de tipo Cross-site scripting Reflejado y Autenticado en el parámetro BCC en MDaemon versiones anteriores a 22.0.0 • https://github.com/haxpunk1337/MDaemon-/blob/main/MDaemon%20XSS%20at%20BCC%20endpoint • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVE-2022-29975
https://notcve.org/view.php?id=CVE-2022-29975
11 May 2022 — An Authenticated Reflected Cross-site scripting at CC Parameter was discovered in MDaemon before 22.0.0 . Se ha detectado una vulnerabilidad de tipo Cross-site scriptin Reflejado y Autenticado en el parámetro CC en MDaemon versiones anteriores a 22.0.0 • https://github.com/haxpunk1337/MDaemon-/blob/main/MDaemon%20XSS%20at%20CC%20endpoint • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVE-2021-27183
https://notcve.org/view.php?id=CVE-2021-27183
14 Apr 2021 — An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new files in any location of the filesystem, or he may be able to modify existing files. This vulnerability may directly lead to Remote Code Execution. Se detectó un problema en MDaemon versiones anteriores a 20.0.4. • https://github.com/chudyPB/MDaemon-Advisories • CWE-610: Externally Controlled Reference to a Resource in Another Sphere •

CVE-2021-27182
https://notcve.org/view.php?id=CVE-2021-27182
14 Apr 2021 — An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient). It can be exploited via an email message. It allows an attacker to perform any action with the privileges of the attacked user. Se detectó un problema en MDaemon versiones anteriores a 20.0.4. • https://github.com/chudyPB/MDaemon-Advisories • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •

CVE-2021-27181
https://notcve.org/view.php?id=CVE-2021-27181
14 Apr 2021 — An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit this issue, the user has to click on a malicious URL provided by the attacker and successfully authenticate into the application. Having the value of the anti-CSRF token, the attacker may trick the user into visiting his malicious page and performing any request with the privileges of attacked user. Se detectó un problema en MDaemon versiones anteriores... • https://github.com/chudyPB/MDaemon-Advisories • CWE-352: Cross-Site Request Forgery (CSRF) •

CVE-2021-27180
https://notcve.org/view.php?id=CVE-2021-27180
14 Apr 2021 — An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail (aka WorldClient). It can be exploited via a GET request. It allows performing any action with the privileges of the attacked user. Se detectó un problema en MDaemon versiones anteriores a 20.0.4. • https://github.com/chudyPB/MDaemon-Advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVE-2019-8983
https://notcve.org/view.php?id=CVE-2019-8983
21 Feb 2019 — MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2). MDaemon Webmail, en sus versiones 14.x hasta las 18.x anteriores a la 18.5.2, tiene Cross-Site Scripting (XSS) (fallo 1 de 2). • https://www.altn.com/Support/SecurityUpdate/MD021519_MDaemon_EN • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVE-2019-8984
https://notcve.org/view.php?id=CVE-2019-8984
21 Feb 2019 — MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2). MDaemon Webmail, en sus versiones 14.x hasta las 18.x anteriores a la 18.5.2, tiene Cross-Site Scripting (XSS) (fallo 2 de 2). • https://www.altn.com/Support/SecurityUpdate/MD021519_MDaemon_EN • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVE-2012-2584 – Alt-N MDaemon free 12.5.4 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-2584
12 Aug 2012 — Multiple cross-site scripting (XSS) vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) the Cascading Style Sheets (CSS) expression property in conjunction with a CSS comment within the STYLE attribute of an IMG element, (2) the CSS expression property in conjunction with multiple CSS comments within the STYLE attribute of an arbitrary element, or (3) an innerHTML attribute within an XML document. Múltiples vulnerabil... • https://www.exploit-db.com/exploits/20357 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVE-2008-6967
https://notcve.org/view.php?id=CVE-2008-6967
13 Aug 2009 — Multiple unspecified vulnerabilities in WorldClient in Alt-N MDaemon before 10.02 have unknown impact and attack vectors, probably related to cross-site scripting (XSS) and WorldClient DLL 10.0.1, a different vulnerability than CVE-2008-6893. Múltiples vulnerabilidad no especificada en WorldClient en Alt-N MDaemon anteriores a v10.02 tienen impacto desconocido y vector de ataque, probablemente relativo a de ejecución de secuencias de comandos en sitios cruzados - XSS - WorldClient DLL v10.0.1, una vulnerabi... • http://files.altn.com/MDaemon/Release/RelNotes_en.txt •